@sema-agent/server 6.6.0 → 6.8.0

package/dist/bake-runner/main.js

@@ -15,6 +15,14 @@ import { parseNumOrFailNonNegative } from "../config.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { BakeRunner, } from "./runner.js";
 const exec = promisify(execCb);
+// 鲁棒性批5 A3(2026-08-05):claim/ingest/heartbeat 三个 fetch 此前零超时——bake-runner 的整条 loop()
+// 是这台构建宿主机唯一的主循环,一次悬挂的 image-api 连接(网络分区/黑洞 TCP)会让 claim/heartbeat 永久
+// 挂起,直到底层 socket 超时(可能几十分钟),期间既不上报心跳也不能认领新 bake——整机静默停摆。
+// 上界两档:claim/ingest 不在心跳热路径,给 30s 吃满慢网 RTT + 大 body;heartbeat 必须显著小于
+// BAKE_HEARTBEAT_MS 的默认量级(30s)——否则一次超时本身就吃掉一整个心跳周期,取 10s(同
+// fleet-client.ts `FLEET_CLIENT_FETCH_TIMEOUT_MS` 判据的普适形)。
+const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
+const BAKE_HEARTBEAT_FETCH_TIMEOUT_MS = 10_000;
 function loadEnv() {
     const need = (k) => {
         const v = process.env[k];
@@ -55,6 +63,7 @@ function makeApiClient(env, log) {
                 method: "POST",
                 headers: auth,
                 body: JSON.stringify({ runnerId: env.runnerId }),
+                signal: AbortSignal.timeout(BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS),
             });
             if (res.status === 204)
                 return null; // empty queue — the routine "nothing to do" case, no log line
@@ -93,6 +102,7 @@ function makeApiClient(env, log) {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify(frame),
+                signal: AbortSignal.timeout(BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS),
             });
             const body = res.ok ? (await res.json().catch(() => ({}))) : {};
             return {
@@ -107,6 +117,7 @@ function makeApiClient(env, log) {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify({ event: "heartbeat" }),
+                signal: AbortSignal.timeout(BAKE_HEARTBEAT_FETCH_TIMEOUT_MS),
             });
             const body = res.ok ? (await res.json().catch(() => ({}))) : {};
             return {

package/dist/boot/leader.d.ts

@@ -23,5 +23,16 @@ export interface LeaderCtx {
     sessionStore: ReturnType<StoreBackend["session"]>;
     checkpointStore: CheckpointStoreFull | undefined;
 }
+/**
+ * 鲁棒性批5 A6(2026-08-05):k8s 腿要求 MinIO 三件套(ENDPOINT/ACCESS_KEY/SECRET_KEY)全在——半开(一件缺)
+ * 就让 `leaderEndpoint` 的三元式落到 undefined,此前**零披露**:运维显式开了 LEADER_ENABLED +
+ * REMOTE_EXEC=k8s,却在日志里既看不到 `leader_endpoint_enabled` 也看不到任何"为什么没启用"的信号——只能
+ * 靠读源码才知道要去检查 MinIO 三件套。
+ *
+ * 纯谓词,抽出独立函数:只吃 leaderEnabled/leaderProvider/hasS3 三个原语 + 直接读 process.env 取缺失的
+ * 具体变量名,不依赖完整 `LeaderCtx`(构造一整套 brain/pricing/sessionStore 只为测一个 warn 分支不值当)。
+ * 返回 null = 不适用该警告(未开启/非 k8s 腿/三件套齐全);非 null = 该报警,携带具体缺的变量名列表。
+ */
+export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider: string | undefined, hasS3: boolean): string[] | null;
 export declare function createLeaderFace(ctx: LeaderCtx): ReturnType<typeof createLeaderEndpoint> | undefined;
 //# sourceMappingURL=leader.d.ts.map

package/dist/boot/leader.js

@@ -1,5 +1,24 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
 import { createLeaderRunner } from "../leader/wire.js";
+/**
+ * 鲁棒性批5 A6(2026-08-05):k8s 腿要求 MinIO 三件套(ENDPOINT/ACCESS_KEY/SECRET_KEY)全在——半开(一件缺)
+ * 就让 `leaderEndpoint` 的三元式落到 undefined,此前**零披露**:运维显式开了 LEADER_ENABLED +
+ * REMOTE_EXEC=k8s,却在日志里既看不到 `leader_endpoint_enabled` 也看不到任何"为什么没启用"的信号——只能
+ * 靠读源码才知道要去检查 MinIO 三件套。
+ *
+ * 纯谓词,抽出独立函数:只吃 leaderEnabled/leaderProvider/hasS3 三个原语 + 直接读 process.env 取缺失的
+ * 具体变量名,不依赖完整 `LeaderCtx`(构造一整套 brain/pricing/sessionStore 只为测一个 warn 分支不值当)。
+ * 返回 null = 不适用该警告(未开启/非 k8s 腿/三件套齐全);非 null = 该报警,携带具体缺的变量名列表。
+ */
+export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
+    if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
+        return null;
+    return [
+        !process.env.MINIO_ENDPOINT && "MINIO_ENDPOINT",
+        !process.env.MINIO_ACCESS_KEY && "MINIO_ACCESS_KEY",
+        !process.env.MINIO_SECRET_KEY && "MINIO_SECRET_KEY",
+    ].filter((v) => typeof v === "string");
+}
 export function createLeaderFace(ctx) {
     const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore } = ctx;
     // v2 leader endpoint (design/50 + design/68): wire when LEADER_ENABLED + an isolated remote-exec backend
@@ -19,6 +38,9 @@ export function createLeaderFace(ctx) {
         }
         : {};
     const leaderProvider = config.remoteExec?.provider;
+    const minioGap = leaderK8sMinioGap(config.leaderEnabled, leaderProvider, "s3" in leaderMinio);
+    if (minioGap)
+        logger.warn("leader_k8s_minio_incomplete", { missing: minioGap });
     // DUAL-MODE §5: orchestration is an ENGINE capability, not fleet-only — the TOC `host` lane runs leader fan-out
     // bounded by ONE box (isolation=none, NON-durable: no snapshot, so the durable sub-worker suspend block below is
     // skipped — host workers run to completion in-process-adjacent). e2b/k8s keep their isolated/suspendable posture.

package/dist/config.js

@@ -491,9 +491,11 @@ function parseStoreDomain(ctx) {
                 user: env("MYSQL_USER"),
                 password: env("MYSQL_PASSWORD", ""),
                 database: env("MYSQL_DATABASE"),
-                connectionLimit: process.env.MYSQL_POOL_SIZE
-                    ? Number(process.env.MYSQL_POOL_SIZE)
-                    : undefined,
+                // 鲁棒性批5 A2(2026-08-05):此前裸 `Number(process.env.MYSQL_POOL_SIZE)` ——一个手滑值(如
+                // "20;drop") → NaN,driver 的 `connectionLimit` 直接拿到 NaN 而不是走池大小默认,行为因驱动
+                // 而异(未必 fail-loud)。optFinitePositiveEnv 与 dbQueryTimeoutMs 同款:非法值回默认(undefined
+                // = driver 默认池大小)+ S20 boot 警告,合法值照常生效。
+                connectionLimit: optFinitePositiveEnv("MYSQL_POOL_SIZE"),
             }
             : undefined,
         pg: needsDb && dbBackend === "pg"
@@ -503,7 +505,8 @@ function parseStoreDomain(ctx) {
                 user: env("PG_USER"),
                 password: env("PG_PASSWORD", ""),
                 database: env("PG_DATABASE"),
-                connectionLimit: process.env.PG_POOL_SIZE ? Number(process.env.PG_POOL_SIZE) : undefined,
+                // 同 MYSQL_POOL_SIZE 族(鲁棒性批5 A2)。
+                connectionLimit: optFinitePositiveEnv("PG_POOL_SIZE"),
             }
             : undefined,
         // S9 deeper fix: per-query DB timeout (see the interface doc). Soft knob — a typo degrades to the default
@@ -1177,7 +1180,12 @@ function parseOrchestrationDomain(ctx) {
                                                         ...(process.env.DOCKER_HOST ? { dockerHost: process.env.DOCKER_HOST } : {}),
                                                         ...(process.env.DOCKER_MEMORY ? { memory: process.env.DOCKER_MEMORY } : {}),
                                                         ...(process.env.DOCKER_CPUS ? { cpus: Number(process.env.DOCKER_CPUS) } : {}),
-                                                        ...(process.env.DOCKER_PIDS_LIMIT ? { pidsLimit: Number(process.env.DOCKER_PIDS_LIMIT) } : {}),
+                                                        // 鲁棒性批5 A1(2026-08-05):此前裸 `Number(process.env.DOCKER_PIDS_LIMIT)`——非数字值(如
+                                                        // 手滑的 "512;") → NaN,而消费端(local-docker 执行环境)对 `pidsLimit` 的守卫是
+                                                        // `?? 512`(只挡 null/undefined),NaN 穿透守卫;随后 `NaN > 0` 恒假,`--pids-limit` 整个
+                                                        // 从 docker run 参数里省略——运维以为设了 fork-bomb 背栓,实际背栓被静默卸掉。
+                                                        // optFinitePositiveEnv:非法值回 undefined(消费端默认 512 生效)+ S20 boot 警告。
+                                                        ...((n) => (n !== undefined ? { pidsLimit: n } : {}))(optFinitePositiveEnv("DOCKER_PIDS_LIMIT")),
                                                         ...(boolEnv("DOCKER_DROP_CAPS", false) ? { dropAllCaps: true } : {}),
                                                         ...(process.env.DOCKER_NETWORK
                                                             ? { network: enumEnv("DOCKER_NETWORK", "bridge", ["none", "bridge", "host"]) }

package/dist/http/routes/session-sync.js

@@ -2,7 +2,7 @@ import { once } from "node:events";
 import { randomBytes, createHash } from "node:crypto";
 import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, SessionError, SessionPolicyError } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
-import { exportSessionManifest, fileSnapshotImportFace } from "../../session-sync.js";
+import { exportSessionManifest, fileSnapshotImportFace, replayPolicyRecords, overwriteWipeIncapable, wipeSessionAttendants } from "../../session-sync.js";
 import { classifySyncRelationshipByIds, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape } from "../../security.js";
 import { sendJson, sendError, msg } from "../send.js";
@@ -392,9 +392,10 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                         }
                     }
                     const opOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
+                    // #137 ①:等内容跳过(replayPolicyRecords)——这条腿在**每次** identical 重推上都跑,
+                    // 无条件 putRules 会把 rev(operator 乐观锁 CAS 令牌)按重推次数推着走。
                     if (deps.sessionPolicyStore)
-                        for (const rec of policy)
-                            await deps.sessionPolicyStore.putRules(sessionId, rec.principal, rec.rules, { operator: opOk });
+                        await replayPolicyRecords(deps.sessionPolicyStore, sessionId, policy, opOk);
                     const importingP = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                     if (deps.resumeAnchorStore)
                         for (const a of anchors)
@@ -419,6 +420,10 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                 }
                 // §4 active-run guard (don't drop a live append) + per-session import lease (don't let two staged imports race
                 // to commit the same session). Both 409.
+                // `runStore?.` 的可选链不是守卫豁免面(鲁棒性批5 #7 亲验定性,2026-08-06):runStore 仅在
+                // **backend 整体缺席**时才 undefined(tidb/pg/local 三形态的 backend.run() 全都在,main.ts:378),
+                // 而 backend 缺席时本路由的 Phase A 已在 `beginImportStaging` 探测处硬 501(capability.session_store_
+                // required)——「守卫被跳过而 sync 仍可达」的组合按构造不存在(能力面与路由解析同真值)。
                 const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
                 if (activeTaskId) {
                     sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId });
@@ -647,9 +652,29 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                     sendError(res, 409, "session_active", "session started an active run while the import streamed; sync after it settles", { activeTaskId: activeAtCommit });
                     return;
                 }
-                // ── commit (the atomic swap) → replay snapshots/policy/anchors → cache evict → release lease ──
+                // #137 ② 能力预检(fail-loud,[2195] 判据:保护型能力缺席=fail-closed):consent 了 overwrite
+                // 而 policy 店无 purge seam ⇒ 在 commit **之前**干净中止(此刻零写入落地),绝不静默留混合态。
+                // 只看 resolution 不看 relation(commit 的 in-txn re-classify 还没跑):保守方向——你要求了
+                // overwrite 而这套部署擦不动,哪怕最终 re-classify 判 fresh 也先拒,拒因里给了无损重跑姿势。
+                if (pending.resolution !== undefined && overwriteWipeIncapable(deps.sessionPolicyStore)) {
+                    await pending.handle.abort().catch(() => undefined);
+                    cleanupStaging(stagingId);
+                    sendError(res, 501, "capability.policy_purge_required", "overwrite-dst cannot proceed: this deployment's session-policy store has no deleteBySession purge seam, so the destination's stale policy rows cannot be wiped and the import would land a MIXED state (the source's conversation plus the destination's leftover policy rows, which keep gating). Upgrade the policy store (every in-tree store carries deleteBySession since core 1.423), or re-run without resolution overwrite-dst");
+                    return;
+                }
+                // ── commit (the atomic swap) → wipe (overwrite-dst) → replay snapshots/policy/anchors → cache evict → release lease ──
                 try {
                     const committed = await pending.handle.commit(pending.owner, pending.resolution ? { resolution: pending.resolution } : undefined);
+                    // #137 ②(死码 ⓪ 擦除步的活路由移植,判据钉=fanout-characterization L2):consented
+                    // overwrite-dst = keep-source ⇒ 在重放**之前**擦掉目的端遗留的 policy/anchor/快照行,否则
+                    // 悬空 anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、共享 key 快照因
+                    // importManifest create-once 永远留着目的端字节。条件按 commit 权威 relation 收窄:fresh 不擦
+                    // (B5 钉:注册过但零 entry 的目的端,原有附随物原地留存)、fast_forward 不擦(同支延长,无
+                    // 被放弃分支)。崩溃残余(commit 与 wipe 之间死进程 ⇒ 重试落 identical 支无 wipe)在
+                    // wipeSessionAttendants 的 doc 注如实记录——窗口窄于修前(修前=遗留行恒存活)。
+                    if (pending.resolution === "overwrite-dst" && (committed.relation === "fork" || committed.relation === "stale")) {
+                        await wipeSessionAttendants({ fileSnapshotStore: deps.fileSnapshotStore, sessionPolicyStore: deps.sessionPolicyStore, resumeAnchorStore: deps.resumeAnchorStore }, sessionId);
+                    }
                     // ① snapshots — content-addressed import (idempotent). importManifest never throws → a {ok:false} is a
                     //    fail-closed 422 (a blob the Phase-A presence check couldn't catch — corrupted in transit). Note: the
                     //    ENTRIES are already committed (the swap), so a snapshot failure here means the conversation synced but a
@@ -666,10 +691,11 @@ async function handleSessionSyncBody(req, res, url, ctx, miss) {
                         }
                     }
                     // ② policy — replay each record; the E6 tighten-only gate applies unless the importer is a verified operator.
+                    //    #137 ①:等内容跳过(replayPolicyRecords)——crash-retry 会整段重跑本重放,无条件 put 让
+                    //    每次重试都推 rev(operator 乐观锁 CAS 令牌)。
                     const policyStore = deps.sessionPolicyStore;
                     if (policyStore)
-                        for (const rec of pending.policy)
-                            await policyStore.putRules(sessionId, rec.principal, rec.rules, { operator: pending.operatorOk });
+                        await replayPolicyRecords(policyStore, sessionId, pending.policy, pending.operatorOk);
                     // ③ anchors — owner RE-KEYED to the importing principal (§9).
                     const anchorStore = deps.resumeAnchorStore;
                     if (anchorStore)

package/dist/leader/wire.d.ts

@@ -1,6 +1,6 @@
 import { type Brain, type Model, type ModelRoles, type ModelPricing, type TaskSpec, type ExecutionEnvFactory, type RemoteExecutionEnv, type ToolResultStore, type SessionStore } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../plugins/store-backend.js";
-import { type LeaderResult } from "./leader.js";
+import { type LeaderDeps, type LeaderResult } from "./leader.js";
 import type { LeaderRequestBody } from "./endpoint.js";
 export interface LeaderWireConfig {
     /** Static-env compat mode (E2B only): the leader provisions/owns each env. Required when `envFactory` unset. */
@@ -162,6 +162,16 @@ export declare function leaderLoopConfig(cfg: {
     repairRounds?: number;
     conflictRounds?: number;
 }, env?: NodeJS.ProcessEnv): LeaderLoopConfig;
+export declare const LEADER_PUSH_NETWORK_TIMEOUT_MS = 120000;
+export declare const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30000;
+/** Coordinator(control plane,持有推送凭据)的 git push 闭包——从 `createLeaderRunner` 抽出为独立工厂,
+ *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
+ *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
+ *  唯一新增是六条 execFileSync 各自的 `timeout`。 */
+export declare function createCoordinatorPush(durableRemote: string, targetRef: string | undefined, ident: {
+    name: string;
+    email: string;
+}): LeaderDeps["push"];
 export declare function createLeaderRunner(cfg: LeaderWireConfig): (body: LeaderRequestBody) => Promise<LeaderResult>;
 export {};
 //# sourceMappingURL=wire.d.ts.map

package/dist/leader/wire.js

@@ -177,6 +177,68 @@ export function leaderLoopConfig(cfg, env = process.env) {
         ...(env.LEADER_BUDGET_USD ? { replanBudgetUsd: parseNumOrFailNonNegative("LEADER_BUDGET_USD", env.LEADER_BUDGET_USD) } : {}),
     };
 }
+// 鲁棒性批5 A4(2026-08-05):Coordinator 的六条 execFileSync(clone/config×2/am/ls-remote/push×2)此前零超时。
+// `execFileSync` 是**同步**调用——它挂起的是整个 Node 事件循环,不只是这一次 leader 跑;`durableRemote`
+// 是运维配的、可能半开/不可达的远端(DNS 黑洞、TCP SYN 丢、对端 git-upload-pack 卡死),一旦挂住,这一个
+// 副本上**所有并发请求**一起冻结,直到操作系统层 TCP 超时(可能几十分钟)才会松绑。
+// 上界两档:clone/push/ls-remote 是网络往返(仓可能较大,给 120s);config/am 是纯本地操作(不该合法挂起,
+// 但损坏的 object store / 文件锁可能卡住 `git am`),给 30s——同 fleet-client.ts `FLEET_CLIENT_FETCH_TIMEOUT_MS`
+// 判据的普适形(操作分类决定上界,不是一刀切）。
+export const LEADER_PUSH_NETWORK_TIMEOUT_MS = 120_000;
+export const LEADER_PUSH_LOCAL_TIMEOUT_MS = 30_000;
+/** Coordinator(control plane,持有推送凭据)的 git push 闭包——从 `createLeaderRunner` 抽出为独立工厂,
+ *  仅依赖 durableRemote/targetRef/git 身份(不依赖 wire 内其余状态),因此可以脱离完整的
+ *  plan→provision→fan-out→merge 管线单测(那条管线需要真 brain + E2B/k8s env)。行为与抽出前逐字相同,
+ *  唯一新增是六条 execFileSync 各自的 `timeout`。 */
+export function createCoordinatorPush(durableRemote, targetRef, ident) {
+    return async (integratedPatch, baseSha) => {
+        // Coordinator (control plane, creds): clone durable remote, apply integrated series, force-with-lease push.
+        // 🔴 requires `git` on the service host PATH (deploy req).
+        const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
+        // Force C locale so the `raced` regex below matches git's (English) push-rejection messages regardless of
+        // the host locale — otherwise a translated message → regex miss → a real race mislabeled non-retryable (council #5).
+        const gitEnv = { ...process.env, LC_ALL: "C" };
+        try {
+            execFileSync("git", ["clone", "-q", durableRemote, dir], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.name", ident.name], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            execFileSync("git", ["-C", dir, "config", "user.email", ident.email], { timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            writeFileSync(join(dir, ".leader.patch"), integratedPatch);
+            execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv, timeout: LEADER_PUSH_LOCAL_TIMEOUT_MS });
+            rmSync(join(dir, ".leader.patch"));
+            const ref = targetRef ?? "refs/heads/main";
+            // CAS against the TARGET ref's ACTUAL current tip (not baseSha). The old `=ref:baseSha` lease assumed
+            // the target ref already pointed at baseSha — but a FRESH ref (or one at any other commit) is never at
+            // baseSha, so the lease rejected EVERY such push and mislabeled it "raced" (found live: auto1 reached
+            // push after a clean 6-worker fan-out + green gradle, and failed only here). ls-remote gives the ref's
+            // current oid (empty = it doesn't exist yet) → lease against THAT, which still detects a real concurrent
+            // merge race (the ref moved since we read it) but lets a normal create/update through.
+            // Does the target ref already exist? (exact full-ref match; --refs drops peeled annotated-tag lines.)
+            const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
+            if (exists) {
+                // Existing ref → keep the original CAS against baseSha (detects a concurrent merge that moved the ref
+                // off the base this run started from — council#2). NOT against a just-read end-of-run tip: that would
+                // let leader B force-push over leader A's concurrent merge (Codex review #1). A ref that exists but
+                // isn't at baseSha → refuse (use a fresh per-run targetRef to avoid that — the proving-ground does).
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            }
+            else {
+                // Absent → create with a "must not exist" lease (empty expected oid): a concurrent create races safely
+                // (rejected as stale info) instead of silently fast-forwarding. The original `:baseSha` lease wrongly
+                // rejected a fresh ref (it's never at baseSha) — that was auto1's only failure after a green build.
+                execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv, timeout: LEADER_PUSH_NETWORK_TIMEOUT_MS });
+            }
+            return { ok: true, ref };
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            return { ok: false, raced: /stale info|force-with-lease|\[rejected\]|non-fast-forward/.test(msg), error: msg };
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
+}
 export function createLeaderRunner(cfg) {
     const W = cfg.workspace ?? "/home/user";
     const repo = `${W}/repo`;
@@ -563,53 +625,7 @@ export function createLeaderRunner(cfg) {
             }
             return { env: asIntegrationEnv(env), destroy: () => env.destroy().then(() => { }), ...(mkRepair(env, repo, body.oracleFiles ?? []) ? { repair: mkRepair(env, repo, body.oracleFiles ?? []) } : {}), ...(mkConflictResolver(env, repo, body.oracleFiles ?? []) ? { conflictResolver: mkConflictResolver(env, repo, body.oracleFiles ?? []) } : {}) };
         };
-        const push = async (integratedPatch, baseSha) => {
-            // Coordinator (control plane, creds): clone durable remote, apply integrated series, force-with-lease push.
-            // 🔴 requires `git` on the service host PATH (deploy req).
-            const dir = mkdtempSync(join(tmpdir(), "leader-coord-"));
-            // Force C locale so the `raced` regex below matches git's (English) push-rejection messages regardless of
-            // the host locale — otherwise a translated message → regex miss → a real race mislabeled non-retryable (council #5).
-            const gitEnv = { ...process.env, LC_ALL: "C" };
-            try {
-                execFileSync("git", ["clone", "-q", body.durableRemote, dir], { env: gitEnv });
-                execFileSync("git", ["-C", dir, "config", "user.name", ident.name]);
-                execFileSync("git", ["-C", dir, "config", "user.email", ident.email]);
-                writeFileSync(join(dir, ".leader.patch"), integratedPatch);
-                execFileSync("git", ["-C", dir, "am", "--3way", ".leader.patch"], { env: gitEnv });
-                rmSync(join(dir, ".leader.patch"));
-                const ref = body.targetRef ?? "refs/heads/main";
-                // CAS against the TARGET ref's ACTUAL current tip (not baseSha). The old `=ref:baseSha` lease assumed
-                // the target ref already pointed at baseSha — but a FRESH ref (or one at any other commit) is never at
-                // baseSha, so the lease rejected EVERY such push and mislabeled it "raced" (found live: auto1 reached
-                // push after a clean 6-worker fan-out + green gradle, and failed only here). ls-remote gives the ref's
-                // current oid (empty = it doesn't exist yet) → lease against THAT, which still detects a real concurrent
-                // merge race (the ref moved since we read it) but lets a normal create/update through.
-                // Does the target ref already exist? (exact full-ref match; --refs drops peeled annotated-tag lines.)
-                const ls = execFileSync("git", ["-C", dir, "ls-remote", "--refs", "origin", ref], { encoding: "utf8", env: gitEnv });
-                const exists = ls.split("\n").some((l) => l.split("\t")[1] === ref);
-                if (exists) {
-                    // Existing ref → keep the original CAS against baseSha (detects a concurrent merge that moved the ref
-                    // off the base this run started from — council#2). NOT against a just-read end-of-run tip: that would
-                    // let leader B force-push over leader A's concurrent merge (Codex review #1). A ref that exists but
-                    // isn't at baseSha → refuse (use a fresh per-run targetRef to avoid that — the proving-ground does).
-                    execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:${baseSha}`, "origin", `HEAD:${ref}`], { env: gitEnv });
-                }
-                else {
-                    // Absent → create with a "must not exist" lease (empty expected oid): a concurrent create races safely
-                    // (rejected as stale info) instead of silently fast-forwarding. The original `:baseSha` lease wrongly
-                    // rejected a fresh ref (it's never at baseSha) — that was auto1's only failure after a green build.
-                    execFileSync("git", ["-C", dir, "push", `--force-with-lease=${ref}:`, "origin", `HEAD:${ref}`], { env: gitEnv });
-                }
-                return { ok: true, ref };
-            }
-            catch (e) {
-                const msg = e instanceof Error ? e.message : String(e);
-                return { ok: false, raced: /stale info|force-with-lease|\[rejected\]|non-fast-forward/.test(msg), error: msg };
-            }
-            finally {
-                rmSync(dir, { recursive: true, force: true });
-            }
-        };
+        const push = createCoordinatorPush(body.durableRemote, body.targetRef, ident);
         const deps = {
             plan,
             provisionWorker,

package/dist/runs.js

@@ -362,7 +362,9 @@ promptManifests) {
     // run-store mutation/poll below (the run row was created with owner = principal ?? null).
     const owner = principal ?? null;
     const heartbeat = setInterval(() => {
-        void runStore.heartbeat(taskId, owner).catch(() => undefined);
+        // 鲁棒性批5 A5(2026-08-05):与下面 cancel/preempt 两条兄弟同族——此前裸吞错,store 持续故障期间本 run
+        // 的心跳每拍静默落空、运维零信号,直到某个副本的 reapStale 把它误判死亡(心跳失败正是那个误判的前兆)。
+        void runStore.heartbeat(taskId, owner).catch(() => { metrics?.inc("run_signal_poll_errors_total", { kind: "heartbeat" }); });
         // Cross-replica cancel: the cancel may have landed on another instance, which only set the durable flag.
         // Poll it here so the OWNING instance aborts its in-flight run (bounded by HEARTBEAT_MS).
         // 鲁棒性批3 A5(2026-08-04,§M 感知链路):poll 失败本身有界(下一拍重试),但此前**零披露**——

package/dist/session-sync.d.ts

@@ -1,23 +1,55 @@
 /**
- * 2c session-sync — P1b ORCHESTRATION: export a session's WHOLE portable state from one StoreBackend and import it
- * verbatim into another (the seamless local↔cloud "save state" move; sema-internal server/docs/DESIGN-session-sync.md §5–§10). All the
- * per-store PRIMITIVES already exist (P1a entries + P1b snapshots/policy/anchor); this module is the COORDINATOR that
- * (a) reads them into a {@link SessionBundle} and (b) replays them across backends in the §8 fail-closed atomic order.
+ * 2c session-sync — P1d-α PULL manifest export (`exportSessionManifest`) + §7 dry-run planning (`planSync`) over a
+ * `StoreBackend` (sema-internal server/docs/DESIGN-session-sync.md §5–§10, §15). The PUSH half is the two-phase
+ * staged streamed import in `src/http/routes/session-sync.ts` (§8 fanout re-implemented there, entries-off-the-wire).
  *
- * This is a SERVICE function — the caller (the future HTTP route, P1d) owns the `sessionOwnerScope` gate (§9: export
- * 404s a non-owner, import re-stamps owner to the authenticated principal). exportSession/importSession themselves do
- * NOT authenticate; they assume the caller proved ownership.
+ * 🪦 **TOMBSTONE (2026-08-06, mechanical removal car, [2557] 2-i precondition + #51 死码判定)**: this module used to
+ * ALSO export a whole-bundle `exportSession`/`importSession` orchestrator pair (the P1b one-shot in-memory move:
+ * read entries+snapshots+policy+anchors into one {@link SessionBundle}, replay them across backends in the §8
+ * atomic order). #51's audit (src git history around this date; see `test/session-sync-routes.test.ts`'s former
+ * "死码判定的常驻门" describe, now a removal-proof tombstone test) established BOTH functions had **zero production
+ * call sites** — PULL uses `exportSessionManifest` below + the keyset-paged NDJSON `/sync/entries` stream; PUSH uses
+ * the two-phase staging route, which reimplements the §8 fanout itself (`handle.commit` / `importManifest` /
+ * `putRules` / `resumeAnchorStore().put`) and never called `importSession`. The only consumers were three test
+ * files. [2557] 2-i's precondition for removal (B4/G1 re-anchored to the live streaming path) was met, so this car
+ * deleted both functions + the tests that existed solely to exercise them.
  *
- * Scope (P1b): a one-shot whole-session move with FAIL-CLOSED validation (§10) + cross-store atomic ordering (§8) +
- * owner re-stamp (§9). NOT in scope here: sync-watermark / fork detection (§7) and HTTP/streaming blob negotiation
- * (§5) — those are P1c/P1d. Blobs are NOT held in memory (§5 OOM guard): the bundle carries only the manifest
- * (relPath→blobHash); bytes flow through a `getBlob(hash)` getter the importer pulls content-addressed (deduped).
+ * ⚠️ **Two invariants the deleted `importSession` uniquely protected have NO live-route equivalent** (verified by
+ * reading the current code, not assumed) — flagging rather than silently dropping the coverage:
+ *   1. **Policy-rev stability on idempotent retry/duplicate sync** (the deleted ③ step's fix: skip `putRules` when
+ *      the incoming record's content already equals the dst row, so a retried/duplicated sync never bumps `rev` —
+ *      `rev` is the operator's optimistic-lock CAS token). The LIVE two-phase PUSH route (`src/http/routes/
+ *      session-sync.ts` lines ~382 and ~608) calls `sessionPolicyStore.putRules(...)` UNCONDITIONALLY on every
+ *      policy-record replay (identical-branch short-circuit AND the post-commit replay) — no content-equality skip.
+ *      A crash-retry or a harmless duplicate sync on the live PUSH route WILL bump every policy row's rev, unlike
+ *      the now-deleted `importSession`. The deleted tests (fanout-characterization §A A4/A5/A6, §F F1/F1c) pinned
+ *      this ONLY on the dead function; no wire/live-route test exercises it.
+ *   2. **overwrite-dst subsystem wipe** (the deleted ⓪ step: before replaying policy/anchors/snapshots under a
+ *      consented `overwrite-dst`, purge the destination's stale rows for principals/keys NOT in the incoming
+ *      bundle, so an abandoned fork branch's policy/anchor/snapshot rows don't survive as a MIXED state). The LIVE
+ *      two-phase PUSH route has NO equivalent wipe step — its overwrite-dst commit only purges/renames
+ *      `session_event` (entries); the post-commit policy/anchor replay (lines ~606–611) only `put`s the records the
+ *      bundle carries, never deletes a dst-only row. A dangling anchor pointing at a purged entry, or a
+ *      dst-only-principal policy row from the abandoned branch, can survive an overwrite-dst PUSH on the live
+ *      route. The deleted tests (fanout-characterization §C C1/C1b, `session-sync-routes.test.ts`'s deleted
+ *      "[2195] 同族: overwrite-dst wipe" describe) pinned this ONLY on the dead function.
+ * Neither gap is fixed by this car (mechanical removal, no behavior changes) — they are reported here + in the
+ * removal's final report for separate triage (port the fix to the live route, or explicitly accept the regression).
+ *
+ * ✅ **STATUS UPDATE (2026-08-06 同日,#137 红先修绿)**:上面两条「NO live-route equivalent」已作废——
+ * 两个保护都已移植到活路由(本文件尾部 #137 段:`sameRulesContent`/`replayPolicyRecords`/
+ * `overwriteWipeIncapable`/`wipeSessionAttendants`;路由接线=src/http/routes/session-sync.ts 的两条重放腿
+ * + commit 后擦除步 + commit 前能力预检 501)。判据钉=fanout-characterization「#137 live 路由无等价物
+ * 缺口」describe(L1 rev 零漂移+反向臂 / L2 三子系统擦除+共享 key 换源端字节 / L3 缺 seam fail-loud),
+ * L1/L2 先红后绿,两处变异抽验(擦除步禁用⇒L2 红、等值跳过禁用⇒L1 红)。原文保留供考古。
  */
 import type { StoreBackend } from "./plugins/store-backend.js";
 import { type SyncRelation } from "./session-sync-kernel.js";
-import type { SessionTreeEntry, SessionRulesRecord, FileSnapshotResult } from "@sema-agent/core";
+import { type SessionTreeEntry, type SessionRulesRecord, type FileSnapshotResult, type SessionPermissionRules, type StoredSessionRules, type SessionPolicyStore } from "@sema-agent/core";
+import type { ServiceFileSnapshotStore, ServiceSessionPolicyStore, ResumeAnchorStore } from "./plugins/store-backend.js";
 /** A blob getter: content-addressed bytes for a sha256 hash, or `undefined` if the source can't supply them.
- *  Returned by {@link exportSession} (closes over the source store), consumed by {@link importSession}. */
+ *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
+ *  content-addressed snapshot bytes lazily (the live PUSH route's `importManifest` replay). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
 /** The snapshot-import capability face of a `FileSnapshotStore` — signature verbatim = the authoritative
  *  implementation, `FileSnapshotStoreSql.importManifest` (src/plugins/file-snapshot-store-sql.ts:201). */
@@ -83,58 +115,11 @@ export interface SessionManifest {
         owner: string | null;
     }>;
 }
-/**
- * EXPORT a session's whole portable state from `srcBackend` into a {@link SessionBundle} + a {@link BlobGetter}.
- *
- * - entries: `exportEntries(sessionId)` — `null` ⇒ the session does not exist ⇒ this returns `null` (no partial bundle).
- * - snapshots: `listKeys(sessionId)` → for each key `exportManifest(scope,key)` → `{key, [...manifest]}`. A key whose
- *   manifest reads back `null` (a concurrent reap between listKeys and exportManifest) is dropped, not exported empty.
- * - policy: `listBySession(sessionId)` (empty `[]` if the store lacks the optional seam — honest degrade).
- * - anchors: `listBySession(sessionId)` (empty `[]` if the store has no resumeAnchor seam).
- * - getBlob: bound to the source `fileSnapshot().getBlob` so the importer can pull content-addressed bytes lazily.
- *
- * The OWNER is NOT exported (import re-stamps it, §9). The owner-scope GATE is the CALLER's (route P1d): this returns
- * `null` ONLY for "session does not exist", never as an authz signal.
- *
- * NB (P1d-α): the HTTP PULL no longer uses this — it uses {@link exportSessionManifest} (entries lifted off the wire)
- * + the keyset-paged `exportEntriesStream` NDJSON route so memory is bounded by ROW COUNT, not the whole-log array.
- *
- * 🔴 **TEST-ONLY(2026-07-29 死码判定,#51 / [2012] cli 反查;上一版这段 NB 的结论已过期)**。
- * 上面那句「STAYS for the local same-process import path, P1d-β (PUSH), and the tests」**三条里两条已不成立**:
- * 逐条亲验(`grep -rn 'exportSession\|importSession' src/`)——
- *   · **本地同进程 import 路径**:不存在这样的调用点(全仓零处);
- *   · **P1d-β(PUSH)**:路由改成了两阶段 staging + NDJSON 流,§8 扇出**在路由里自己重写了一遍**
- *     (`src/http/routes/session-sync.ts` 的 commit 链直接调 `handle.commit` / `importManifest` / `putRules` /
- *     `resumeAnchorStore`),**不经过** {@link importSession};
- *   · **tests**:成立,且是**唯一**成立的一条(三个测试文件在用)。
- * 还有两处**只 import 不调用**的死接线(`src/http/server.ts` / `src/http/routes/session-sync.ts`)——本次已摘;
- * 它们能活到今天是因为 tsconfig 没开 `noUnusedLocals`。这两个函数也**不在发布公面**上
- * (`package.json` 的 exports 只有 `.` / `./main` / `./package.json`,`src/index.ts` 不 re-export 本模块)。
- *
- * **为什么本批只判定 + 上机器门,没有直接删**:两个仍在用它们的测试文件
- * (`session-sync-fanout-characterization` / `session-sync-fanout-crash-recovery`)是 §8 崩溃/重试幂等语义的
- * **唯一可执行验证**,并且其中 B4/G1 两笔 `it.fails` 记的是 `classifySyncRelationshipByIds` 的**分类缺口**——
- * 而那个分类器**在活路由上仍被调用**(`routes/session-sync.ts:312` / `:632`)。直接删函数=连带删掉两套
- * 覆盖与一笔**仍然有效**的欠账记账,那正是本仓 `vitest.config.ts` 里写死的判据「覆盖丢失伪装成绿,
- * 比假红更坏」。⇒ **删除的前置条件**是先把 B4/G1 重锚到活的流式路径上;做完那件,这两个函数连同它们的
- * 测试可一并摘除。判定与机器门见 `test/session-sync-routes.test.ts` 的「死码判定」describe。
- *
- * ✅ **前置条件已达成**(2026-08-05,[2557] 审计 2-i):B4 已重锚活路由(fanout-characterization §H ×3 +
- * sync-commit-write-parity 三后端判据,commit 半场的 fast_forward 载荷缺口**已修**)并销账;G1 改性质为
- * 「老客户端路现状钉」(wire 级、不依赖本模块)。⇒ 本模块 + 依赖它的测试段现在**可以整体摘除**——
- * 剩余依赖=fanout-characterization §A/§B/§F 与 crash-recovery 全文件(§8 扇出切点矩阵的死码腿;活路由的
- * 崩溃/重试语义已由 E 系列 + staging reaper 钉覆盖,摘除前需逐段核对该等价性)。单独排一班机械车做,
- * 别混进行为修的车。
- */
-export declare function exportSession(sessionId: string, srcBackend: StoreBackend): Promise<{
-    bundle: SessionBundle;
-    getBlob: BlobGetter;
-} | null>;
 /**
  * P1d-α (PULL streaming, §15) — EXPORT a session's portable state as a {@link SessionManifest} (entries LIFTED OFF
- * the wire) + a {@link BlobGetter}. Like {@link exportSession} but it does NOT load entry payloads: it reads the
+ * the wire), so it does NOT load entry payloads: it reads the
  * IDS-only projection via `listEntryIds` (`null` ⇒ no such session ⇒ this returns `null`), counts them, reads the
- * current `leafId`, and builds snapshots/policy/anchors EXACTLY as exportSession does. The paired NDJSON
+ * current `leafId`, and builds snapshots/policy/anchors. The paired NDJSON
  * `GET /sync/entries` route streams the entry payloads separately (keyset-paged → bounded memory), so a 1M-entry
  * session's manifest stays small (ids + counts + the snapshot/policy/anchor metadata).
  *
@@ -146,69 +131,46 @@ export declare function exportSessionManifest(sessionId: string, srcBackend: Sto
     manifest: SessionManifest;
     getBlob: BlobGetter;
 } | null>;
-/**
- * IMPORT a {@link SessionBundle} (+ its {@link BlobGetter}) into `dstBackend` under `bundle.sessionId`, re-stamping
- * ownership to `importingPrincipal`. Returns the snapshot tally (imported vs honestly-skipped on a destination whose
- * FileSnapshotStore lacks the importManifest seam — pre-1.141.0; core's InMemory/File NOW carry it, so a local dst
- * imports snapshots for real).
- *
- * §10 FAIL-CLOSED VALIDATION runs FIRST — BEFORE any write:
- *   1. `validateEntriesForImport(bundle.entries)` (the single core invariant gate: unique ids / parent-before-child /
- *      one root / leaf-resolvable). Throws on violation; NOTHING is written.
- *   2. Every blobHash referenced by every snapshot manifest MUST be supplied by `getBlob` — a missing blob would
- *      restore a PARTIAL tree (files half-written, conversation whole → breaks the entry↔file lockstep). A lightweight
- *      PRESENCE pre-check (fetch each distinct hash once, no hashing) fails FAST here; the AUTHORITATIVE content-address
- *      integrity check (`sha256(bytes)===hash`) is done ONCE inside `importManifest` (core 1.141.0), so we don't double-
- *      hash. (Runs only when the dst supports snapshot import; otherwise there is nothing to half-write.)
- *
- * §7 CLASSIFICATION GATE — BEFORE any write, the destination's CURRENT entry log is read and compared to the bundle
- * via {@link classifySyncRelationship} (a sound entry-id SET comparison, not leaf_id). A `fork` (true divergence) or a
- * `stale` source (the dst is strictly ahead) WOULD lose destination history → it throws {@link SyncConflictError}
- * (route → 409) UNLESS the caller passes `{ resolution: "overwrite-dst" }`. An `identical` relation SKIPS the entries
- * write entirely (the log is already present & equal; the idempotent snapshot/policy/anchor replay below still runs to
- * heal anything missing). `fresh` / `fast_forward` (and an overwrite-resolved fork/stale) write the entries via the
- * IDEMPOTENT {@link OwnerAwareSessionStore.replaceEntries} (purge-then-import) — NOT `importEntries`, whose plain
- * INSERT crashes on a duplicate PK when the session already exists at the destination.
- *
- * §8 CROSS-STORE ATOMIC ORDER + IDEMPOTENCY — session_meta (written LAST inside `replaceEntries`) is the sole
- * commit point, so a crash mid-import leaves orphan blobs/manifests/anchors with NO session_meta = invisible to
- * wake (never a half-session, only collectable orphans). Order:
- *   ① snapshots (manifests + content-addressed blobs) — content-addressed + create-once = idempotent retry-to-completion.
- *      `importManifest` returns a {@link FileSnapshotResult} (NEVER throws — core 1.141.0); a `{ok:false}` (a
- *      rejecting/missing/hash-mismatched blob the §10 pre-check didn't catch — e.g. a blob corrupted in transit) is
- *      re-raised as a fail-closed THROW so the import aborts BEFORE the entries commit (no entry↔file split).
- *   ② entries (`replaceEntries` runs the core gate AGAIN and writes session_meta LAST = the commit point; idempotent
- *      over an existing session — skipped entirely when the relation is `identical`)
- *   ③ policy (replay each record via putRules; `opts.operatorOk` defaults FALSE → the E6 tighten-only gate APPLIES, so
- *      a replay that would LOOSEN an operator-tightened dst policy throws `SessionPolicyError("loosen_forbidden")` —
- *      `operator:true` is set ONLY when the authenticated importer is itself a verified operator)
- *   ④ anchors (owner RE-KEYED to `importingPrincipal`, §9)
- * Steps ③/④ are post-commit; re-running them is idempotent — ③ SKIPS a put whose content already equals the dst row
- * (a "no-op rev bump" is NOT idempotent: rev is the operator's optimistic-lock token — the A6 fix below), ④ is a
- * same-value upsert — so a crash between ②–④ is recovered by a retry that converges to the same bytes.
- *
- * @param opts.resolution — `"overwrite-dst"` consents to a `fork`/`stale` import that overwrites destination history
- *   (the user's keep-source decision); omitted ⇒ such an import is refused with {@link SyncConflictError}.
- * @param opts.operatorOk — when `true`, the policy replay (step ③) is an OPERATOR write (may loosen the dst rules); set
- *   ONLY when the AUTHENTICATED importer is a verified operator. DEFAULT false → the E6 tighten-only gate applies, so a
- *   non-operator import is TIGHTEN-ONLY (design §4): a replay that would loosen an operator-tightened dst session policy
- *   throws `SessionPolicyError("loosen_forbidden")`, which propagates (NOT swallowed) so the route can refuse the loosen.
- */
-export declare function importSession(bundle: SessionBundle, getBlob: BlobGetter, dstBackend: StoreBackend, importingPrincipal: string | null, opts?: {
-    resolution?: "overwrite-dst";
-    operatorOk?: boolean;
-}): Promise<{
-    snapshotsImported: number;
-    snapshotsSkipped: number;
-    relation: SyncRelation["relation"];
-}>;
 /**
  * §7 DRY-RUN — classify what importing `sessionId` from `srcBackend` into `dstBackend` WOULD do, WITHOUT writing
- * anything. The route (P1d) calls this to surface a conflict (fork/stale) to the user BEFORE committing an
- * {@link importSession} (so the shell can present a keep-local / keep-cloud / fork-new choice up front).
+ * anything (the shell can present a keep-local / keep-cloud / fork-new choice up front).
  *
  * Returns `null` when the SOURCE session does not exist (no bundle to plan); otherwise the {@link SyncRelation}
  * between the source's full durable log and the destination's current log (a `null` dst log ⇒ `fresh`). No writes.
  */
 export declare function planSync(sessionId: string, srcBackend: StoreBackend, dstBackend: StoreBackend): Promise<SyncRelation | null>;
+/** #137 ①(死码 A6 修的移植):同内容判据 —— 比较「归一化、去 rev」后的字节形。putRules 每次
+ *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
+ *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
+ *  前走同一函数 ⇒ 两侧同坐标);`stripRev` 去掉记录内嵌的 rev(`listBySession` 的 rules 含 rev,
+ *  它不是内容)。 */
+export declare function sameRulesContent(stored: StoredSessionRules | null, incoming: SessionPermissionRules): boolean;
+/** #137 ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
+ *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在
+ *  putRules 内部,此处不重述)。 */
+export declare function replayPolicyRecords(store: Pick<SessionPolicyStore, "getRules" | "putRules">, sessionId: string, records: readonly SessionRulesRecord[], operatorOk: boolean): Promise<void>;
+/** #137 ② 能力预检(fail-loud 方向,[2195] 判据:保护型能力缺席=fail-closed):consented
+ *  overwrite-dst 需要 policy 店的 `deleteBySession` purge seam 才能不留混合态;缺席=true,路由在
+ *  commit **之前**用它干净中止(此时零写入落地),wire 拒因字面量归路由所有(api-error-text-freeze
+ *  锚字面站点)。anchor 店的 deleteBySession 是类型必填、快照店有 core 必填的 `reap` 兜底,都不构成
+ *  缺席面;唯一可缺的就是 policy 这条(core 接口上是可选方法)。 */
+export declare function overwriteWipeIncapable(policyStore: ServiceSessionPolicyStore | undefined): boolean;
+/** #137 ②(死码 ⓪ 擦除步的移植):consented overwrite-dst = keep-source,结果必须是**源端那
+ *  一份**,不得混成「源端对话 + 目的端遗留 policy/anchor/快照」(混合态比丢历史更危险:悬空
+ *  anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、共享 key 快照因
+ *  importManifest create-once 永远留着目的端字节)。调用时点=commit(原子 swap)成功**之后**、
+ *  附随物重放**之前**:死码在任何写入前擦(其 entries 写本身非原子);活路由有真 commit point,
+ *  擦在 commit 前会在「commit 失败」时留下反向混合态(目的端对话完好、附随物已毁)——方向更坏。
+ *  诚实残余:进程在 commit 与本函数之间崩溃时,重试落 Phase A identical 支(无 wipe)⇒ 遗留行
+ *  可存活;该窗口窄于修前世界(修前=遗留行**恒**存活),与 §8「快照重放失败 ⇒ 422 重试自愈」
+ *  同款接受,记录于此不装没有。
+ *  各店姿势(死码 verbatim 语义):快照=deleteBySession(SQL 孪生:manifest 即删、blob 走异步
+ *  孤儿 GC)缺席则 core 必填 `reap(scope, [])`(内容寻址,他 scope 仍引用的 blob 存活);
+ *  anchor=直调(类型必填);policy=deleteBySession(路由已用 {@link overwriteWipeIncapable}
+ *  预检过,此处缺席=类型外的 JS 层残缺实现,直调抛 TypeError 即 fail-loud)。 */
+export declare function wipeSessionAttendants(stores: {
+    fileSnapshotStore?: ServiceFileSnapshotStore | undefined;
+    sessionPolicyStore?: ServiceSessionPolicyStore | undefined;
+    resumeAnchorStore?: Pick<ResumeAnchorStore, "deleteBySession"> | undefined;
+}, sessionId: string): Promise<void>;
 //# sourceMappingURL=session-sync.d.ts.map

package/dist/session-sync.js

@@ -1,6 +1,5 @@
-import { identicalIdsAlsoIdenticalContent } from "./session-sync-content.js";
-import { classifySyncRelationship, SyncConflictError } from "./session-sync-kernel.js";
-import { validateEntriesForImport, normalizeRules, stripRev } from "@sema-agent/core";
+import { classifySyncRelationship } from "./session-sync-kernel.js";
+import { normalizeRules, stripRev } from "@sema-agent/core";
 /** Single-point capability probe (design/158 R7): does `fs` carry the optional `importManifest` snapshot-import
  *  seam? Returns the bound method (never a naked function reference — `this` inside `importManifest` must resolve
  *  to `fs`, exactly like `asServiceDeps`'s other capability-probe-then-bind authorities) or `undefined` when the
@@ -17,96 +16,11 @@ export function fileSnapshotImportFace(fs) {
 function ownerAware(backend) {
     return backend.session();
 }
-/**
- * EXPORT a session's whole portable state from `srcBackend` into a {@link SessionBundle} + a {@link BlobGetter}.
- *
- * - entries: `exportEntries(sessionId)` — `null` ⇒ the session does not exist ⇒ this returns `null` (no partial bundle).
- * - snapshots: `listKeys(sessionId)` → for each key `exportManifest(scope,key)` → `{key, [...manifest]}`. A key whose
- *   manifest reads back `null` (a concurrent reap between listKeys and exportManifest) is dropped, not exported empty.
- * - policy: `listBySession(sessionId)` (empty `[]` if the store lacks the optional seam — honest degrade).
- * - anchors: `listBySession(sessionId)` (empty `[]` if the store has no resumeAnchor seam).
- * - getBlob: bound to the source `fileSnapshot().getBlob` so the importer can pull content-addressed bytes lazily.
- *
- * The OWNER is NOT exported (import re-stamps it, §9). The owner-scope GATE is the CALLER's (route P1d): this returns
- * `null` ONLY for "session does not exist", never as an authz signal.
- *
- * NB (P1d-α): the HTTP PULL no longer uses this — it uses {@link exportSessionManifest} (entries lifted off the wire)
- * + the keyset-paged `exportEntriesStream` NDJSON route so memory is bounded by ROW COUNT, not the whole-log array.
- *
- * 🔴 **TEST-ONLY(2026-07-29 死码判定,#51 / [2012] cli 反查;上一版这段 NB 的结论已过期)**。
- * 上面那句「STAYS for the local same-process import path, P1d-β (PUSH), and the tests」**三条里两条已不成立**:
- * 逐条亲验(`grep -rn 'exportSession\|importSession' src/`)——
- *   · **本地同进程 import 路径**:不存在这样的调用点(全仓零处);
- *   · **P1d-β(PUSH)**:路由改成了两阶段 staging + NDJSON 流,§8 扇出**在路由里自己重写了一遍**
- *     (`src/http/routes/session-sync.ts` 的 commit 链直接调 `handle.commit` / `importManifest` / `putRules` /
- *     `resumeAnchorStore`),**不经过** {@link importSession};
- *   · **tests**:成立,且是**唯一**成立的一条(三个测试文件在用)。
- * 还有两处**只 import 不调用**的死接线(`src/http/server.ts` / `src/http/routes/session-sync.ts`)——本次已摘;
- * 它们能活到今天是因为 tsconfig 没开 `noUnusedLocals`。这两个函数也**不在发布公面**上
- * (`package.json` 的 exports 只有 `.` / `./main` / `./package.json`,`src/index.ts` 不 re-export 本模块)。
- *
- * **为什么本批只判定 + 上机器门,没有直接删**:两个仍在用它们的测试文件
- * (`session-sync-fanout-characterization` / `session-sync-fanout-crash-recovery`)是 §8 崩溃/重试幂等语义的
- * **唯一可执行验证**,并且其中 B4/G1 两笔 `it.fails` 记的是 `classifySyncRelationshipByIds` 的**分类缺口**——
- * 而那个分类器**在活路由上仍被调用**(`routes/session-sync.ts:312` / `:632`)。直接删函数=连带删掉两套
- * 覆盖与一笔**仍然有效**的欠账记账,那正是本仓 `vitest.config.ts` 里写死的判据「覆盖丢失伪装成绿,
- * 比假红更坏」。⇒ **删除的前置条件**是先把 B4/G1 重锚到活的流式路径上;做完那件,这两个函数连同它们的
- * 测试可一并摘除。判定与机器门见 `test/session-sync-routes.test.ts` 的「死码判定」describe。
- *
- * ✅ **前置条件已达成**(2026-08-05,[2557] 审计 2-i):B4 已重锚活路由(fanout-characterization §H ×3 +
- * sync-commit-write-parity 三后端判据,commit 半场的 fast_forward 载荷缺口**已修**)并销账;G1 改性质为
- * 「老客户端路现状钉」(wire 级、不依赖本模块)。⇒ 本模块 + 依赖它的测试段现在**可以整体摘除**——
- * 剩余依赖=fanout-characterization §A/§B/§F 与 crash-recovery 全文件(§8 扇出切点矩阵的死码腿;活路由的
- * 崩溃/重试语义已由 E 系列 + staging reaper 钉覆盖,摘除前需逐段核对该等价性)。单独排一班机械车做,
- * 别混进行为修的车。
- */
-export async function exportSession(sessionId, srcBackend) {
-    const session = ownerAware(srcBackend);
-    // entries FIRST — null ⇒ no such session ⇒ no bundle at all (the route maps this to 404).
-    const exportEntries = session.exportEntries?.bind(session);
-    if (!exportEntries) {
-        // A backend whose session store lacks the export seam can't be a sync SOURCE (older/in-memory dev store). Treat as
-        // "nothing to export" rather than crash — the route already gates on the durable backend being present.
-        return null;
-    }
-    const entries = await exportEntries(sessionId);
-    if (entries === null)
-        return null; // session does not exist
-    // snapshots — listKeys → per-key manifest. exportManifest may be absent (no snapshot export seam) → no snapshots.
-    const fs = srcBackend.fileSnapshot();
-    const snapshots = [];
-    // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
-    if (typeof fs.exportManifest === "function") {
-        const keys = await fs.listKeys(sessionId);
-        for (const key of keys) {
-            const manifest = await fs.exportManifest(sessionId, key);
-            if (manifest === null)
-                continue; // raced reap between listKeys and exportManifest — skip (never an empty snapshot)
-            snapshots.push({ key, manifest: [...manifest] });
-        }
-    }
-    // policy — every (principal, rules) record across ALL principals (E6 listBySession; optional → []).
-    const policyStore = srcBackend.sessionPolicy();
-    const policy = typeof policyStore.listBySession === "function"
-        ? await policyStore.listBySession(sessionId)
-        : [];
-    // anchors — every E18 resume anchor (eventId→entryId + source owner). resumeAnchor is REQUIRED on all backends.
-    const anchorStore = srcBackend.resumeAnchor();
-    // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
-    // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
-    const anchors = await anchorStore.listBySession(sessionId);
-    // getBlob — bound to the SOURCE snapshot store so the importer pulls bytes content-addressed (deduped), lazily.
-    // A source without getBlob (no blobs to move) supplies a getter that always returns undefined → snapshots with a
-    // missing blob fail the §10 validation below before any write (never a partial restore).
-    const getBlobFn = fs.getBlob?.bind(fs);
-    const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;
-    return { bundle: { sessionId, entries, snapshots, policy, anchors }, getBlob };
-}
 /**
  * P1d-α (PULL streaming, §15) — EXPORT a session's portable state as a {@link SessionManifest} (entries LIFTED OFF
- * the wire) + a {@link BlobGetter}. Like {@link exportSession} but it does NOT load entry payloads: it reads the
+ * the wire), so it does NOT load entry payloads: it reads the
  * IDS-only projection via `listEntryIds` (`null` ⇒ no such session ⇒ this returns `null`), counts them, reads the
- * current `leafId`, and builds snapshots/policy/anchors EXACTLY as exportSession does. The paired NDJSON
+ * current `leafId`, and builds snapshots/policy/anchors. The paired NDJSON
  * `GET /sync/entries` route streams the entry payloads separately (keyset-paged → bounded memory), so a 1M-entry
  * session's manifest stays small (ids + counts + the snapshot/policy/anchor metadata).
  *
@@ -127,7 +41,7 @@ export async function exportSessionManifest(sessionId, srcBackend) {
     // leafId — the session's current leaf (cache-bypassing single read). Absent seam / no leaf ⇒ null.
     const getLeafId = session.getLeafId?.bind(session);
     const leafId = getLeafId ? await getLeafId(sessionId) : null;
-    // snapshots / policy / anchors — IDENTICAL to exportSession (no entry payloads loaded anywhere here).
+    // snapshots / policy / anchors — no entry payloads loaded anywhere here.
     const fs = srcBackend.fileSnapshot();
     const snapshots = [];
     // [2373]B-5b:core 接口 listKeys 必填(恒真半支删);exportManifest? 可选——探测只留真可选的那半。
@@ -148,7 +62,7 @@ export async function exportSessionManifest(sessionId, srcBackend) {
     // [2373]B-5a:ResumeAnchorStore 是三实现的闭合联合、listBySession 全必填——feature-detect 恒真,
     // `: []` 臂不可达([2195] deleteBySession 同判据,那轮漏了这对双胞胎)。直调。
     const anchors = await anchorStore.listBySession(sessionId);
-    // getBlob — bound to the SOURCE snapshot store (content-addressed, lazy), exactly like exportSession.
+    // getBlob — bound to the SOURCE snapshot store (content-addressed, lazy).
     const getBlobFn = fs.getBlob?.bind(fs);
     const getBlob = getBlobFn ? (hash) => getBlobFn(hash) : async () => undefined;
     return {
@@ -156,225 +70,9 @@ export async function exportSessionManifest(sessionId, srcBackend) {
         getBlob,
     };
 }
-/**
- * IMPORT a {@link SessionBundle} (+ its {@link BlobGetter}) into `dstBackend` under `bundle.sessionId`, re-stamping
- * ownership to `importingPrincipal`. Returns the snapshot tally (imported vs honestly-skipped on a destination whose
- * FileSnapshotStore lacks the importManifest seam — pre-1.141.0; core's InMemory/File NOW carry it, so a local dst
- * imports snapshots for real).
- *
- * §10 FAIL-CLOSED VALIDATION runs FIRST — BEFORE any write:
- *   1. `validateEntriesForImport(bundle.entries)` (the single core invariant gate: unique ids / parent-before-child /
- *      one root / leaf-resolvable). Throws on violation; NOTHING is written.
- *   2. Every blobHash referenced by every snapshot manifest MUST be supplied by `getBlob` — a missing blob would
- *      restore a PARTIAL tree (files half-written, conversation whole → breaks the entry↔file lockstep). A lightweight
- *      PRESENCE pre-check (fetch each distinct hash once, no hashing) fails FAST here; the AUTHORITATIVE content-address
- *      integrity check (`sha256(bytes)===hash`) is done ONCE inside `importManifest` (core 1.141.0), so we don't double-
- *      hash. (Runs only when the dst supports snapshot import; otherwise there is nothing to half-write.)
- *
- * §7 CLASSIFICATION GATE — BEFORE any write, the destination's CURRENT entry log is read and compared to the bundle
- * via {@link classifySyncRelationship} (a sound entry-id SET comparison, not leaf_id). A `fork` (true divergence) or a
- * `stale` source (the dst is strictly ahead) WOULD lose destination history → it throws {@link SyncConflictError}
- * (route → 409) UNLESS the caller passes `{ resolution: "overwrite-dst" }`. An `identical` relation SKIPS the entries
- * write entirely (the log is already present & equal; the idempotent snapshot/policy/anchor replay below still runs to
- * heal anything missing). `fresh` / `fast_forward` (and an overwrite-resolved fork/stale) write the entries via the
- * IDEMPOTENT {@link OwnerAwareSessionStore.replaceEntries} (purge-then-import) — NOT `importEntries`, whose plain
- * INSERT crashes on a duplicate PK when the session already exists at the destination.
- *
- * §8 CROSS-STORE ATOMIC ORDER + IDEMPOTENCY — session_meta (written LAST inside `replaceEntries`) is the sole
- * commit point, so a crash mid-import leaves orphan blobs/manifests/anchors with NO session_meta = invisible to
- * wake (never a half-session, only collectable orphans). Order:
- *   ① snapshots (manifests + content-addressed blobs) — content-addressed + create-once = idempotent retry-to-completion.
- *      `importManifest` returns a {@link FileSnapshotResult} (NEVER throws — core 1.141.0); a `{ok:false}` (a
- *      rejecting/missing/hash-mismatched blob the §10 pre-check didn't catch — e.g. a blob corrupted in transit) is
- *      re-raised as a fail-closed THROW so the import aborts BEFORE the entries commit (no entry↔file split).
- *   ② entries (`replaceEntries` runs the core gate AGAIN and writes session_meta LAST = the commit point; idempotent
- *      over an existing session — skipped entirely when the relation is `identical`)
- *   ③ policy (replay each record via putRules; `opts.operatorOk` defaults FALSE → the E6 tighten-only gate APPLIES, so
- *      a replay that would LOOSEN an operator-tightened dst policy throws `SessionPolicyError("loosen_forbidden")` —
- *      `operator:true` is set ONLY when the authenticated importer is itself a verified operator)
- *   ④ anchors (owner RE-KEYED to `importingPrincipal`, §9)
- * Steps ③/④ are post-commit; re-running them is idempotent — ③ SKIPS a put whose content already equals the dst row
- * (a "no-op rev bump" is NOT idempotent: rev is the operator's optimistic-lock token — the A6 fix below), ④ is a
- * same-value upsert — so a crash between ②–④ is recovered by a retry that converges to the same bytes.
- *
- * @param opts.resolution — `"overwrite-dst"` consents to a `fork`/`stale` import that overwrites destination history
- *   (the user's keep-source decision); omitted ⇒ such an import is refused with {@link SyncConflictError}.
- * @param opts.operatorOk — when `true`, the policy replay (step ③) is an OPERATOR write (may loosen the dst rules); set
- *   ONLY when the AUTHENTICATED importer is a verified operator. DEFAULT false → the E6 tighten-only gate applies, so a
- *   non-operator import is TIGHTEN-ONLY (design §4): a replay that would loosen an operator-tightened dst session policy
- *   throws `SessionPolicyError("loosen_forbidden")`, which propagates (NOT swallowed) so the route can refuse the loosen.
- */
-export async function importSession(bundle, getBlob, dstBackend, importingPrincipal, opts) {
-    const sessionId = bundle.sessionId;
-    const fs = dstBackend.fileSnapshot();
-    const importFace = fileSnapshotImportFace(fs);
-    const canImportSnapshots = importFace !== undefined;
-    // ── §7 classification gate, BEFORE any write ───────────────────────────────────────────────────────────────
-    // Read the destination's CURRENT entry log and classify the relationship (sound entry-id set comparison). A fork or
-    // a stale source would lose dst history → refuse with a typed 409 unless the caller explicitly resolved overwrite-dst.
-    const dstEntries = (await ownerAware(dstBackend).exportEntries?.(sessionId)) ?? null;
-    const rel = classifySyncRelationship(bundle.entries, dstEntries);
-    if ((rel.relation === "fork" || rel.relation === "stale") && opts?.resolution !== "overwrite-dst") {
-        throw new SyncConflictError(sessionId, rel); // 409 — surface the exclusive sets so the user picks keep-local/cloud
-    }
-    // ── §10 fail-closed validation, BEFORE any write ────────────────────────────────────────────────────────────
-    // (1) entries invariants (the core gate). validateEntriesForImport throws on any violation; we discard its result
-    //     here (importEntries re-runs it as the authoritative write-time gate) — this is the early fail-closed check so
-    //     we never start writing snapshots for a session whose entries the gate will reject.
-    validateEntriesForImport(bundle.entries);
-    // (2) every referenced blob must be fetchable — ONLY when the destination can actually import snapshots (otherwise
-    //     there is nothing to half-write, so a missing blob is moot; the snapshot is honestly skipped below). Fetch each
-    //     DISTINCT hash once (content-addressed) so a large manifest doesn't refetch. This is a lightweight PRESENCE
-    //     pre-check (fail-FAST before we write any entries) — the AUTHORITATIVE sha256 content-address integrity check is
-    //     done ONCE inside importManifest (core 1.141.0); we deliberately don't re-hash here to avoid double-hashing
-    //     a possibly-large blob set. The importManifest {ok:false} below is the backstop for anything the presence check
-    //     can't see (a blob present-but-corrupted-in-transit, a getBlob that rejects only on a later call).
-    if (canImportSnapshots) {
-        const distinct = new Set();
-        for (const snap of bundle.snapshots)
-            for (const [, hash] of snap.manifest)
-                distinct.add(hash);
-        for (const hash of distinct) {
-            const bytes = await getBlob(hash);
-            if (!bytes) {
-                throw new Error(`session-sync import: missing blob ${hash} for session ${sessionId} (refusing a partial-tree import)`);
-            }
-        }
-    }
-    // ── ⓪ overwrite-dst subsystem WIPE (fork/stale with explicit consent ONLY) ─────────────────────────────────
-    // "overwrite-dst" means the user chose KEEP-SOURCE — the result must be the SOURCE's state, not "the source's
-    // conversation + the destination's leftover policy/anchors/snapshots" (a MIXED state is worse than lost history:
-    // dangling anchors resolve onto purged entries, an abandoned branch's policy rows keep gating, and a shared-key
-    // snapshot keeps the dst's bytes because importManifest is create-once). So before replaying ①/③/④ we wipe the
-    // dst's per-session subsystem state. Crash-safety: the user consented to discarding the dst's state, and every
-    // wipe+replay leg is idempotent → a crash mid-wipe is recovered by the same retry-to-completion as §8's ②–④.
-    //   · snapshots: prefer the purge seam `deleteBySession` (SQL twins: manifests drop now, blobs go to the async
-    //     orphan GC); fall back to the core-REQUIRED `reap(scope, [])` (in-memory/file stores GC unreferenced blobs
-    //     inline — content-addressed, so blobs still referenced by other scopes survive).
-    //   · anchors / policy: `deleteBySession` where the store carries it — since core 1.423 that is EVERY in-tree
-    //     store (the seam is optional on core's SessionPolicyStore interface and implemented by its File/InMemory
-    //     stores too — [1796]§三 → [1801]; the feature-detect stays for third-party stores that predate the seam).
-    const overwriting = (rel.relation === "fork" || rel.relation === "stale") && opts?.resolution === "overwrite-dst";
-    if (overwriting) {
-        const fsWipe = fs;
-        if (typeof fsWipe.deleteBySession === "function")
-            await fsWipe.deleteBySession(sessionId);
-        else
-            await fsWipe.reap(sessionId, []);
-        // 🔴 [2195] 同族(2026-08-01):这两条此前是「有 seam 就删,没有就**静默跳过**」——而本段开头
-        // 逐字论证了为什么必须删(「a MIXED state is worse than lost history:dangling anchors resolve onto
-        // purged entries, an abandoned branch's policy rows keep gating」)。论证了坏状态不可接受,却在能力
-        // 缺席时放行了它自己点名的那个坏状态,且**一声不响**。与 session owner 门那条同族:
-        // **能力探测的失败方向决定整条保证的失败方向**,保护型能力缺席必须 fail-closed。
-        //
-        // 改成 fail-loud:wipe 不了就不继续(此时还**没有**任何写入落地 —— 本段在 §8 的 ①③④ 之前,
-        // 所以抛在这里是干净的中止,不是半写状态)。in-tree 每个 store 自 core 1.423 起都带这个 seam
-        // ⇒ 我们自己的部署零影响;受影响的只有 seam 之前的第三方 store,而它们此前拿到的是坏数据。
-        // 🔴 [2195] 同族(2026-08-01):这两条此前都是「有 seam 就删,没有就**静默跳过**」——而本段开头
-        // 逐字论证了为什么必须删(「a MIXED state is worse than lost history:dangling anchors resolve onto
-        // purged entries, an abandoned branch's policy rows keep gating」)。论证了坏状态不可接受,却在能力
-        // 缺席时放行了它自己点名的那个坏状态,且一声不响。
-        //
-        // 但两条的**类型事实不同**(旧码用同一个 `as { deleteBySession?: … }` 把两者抹平了,那个 `as` 正是
-        // 遮蔽物):
-        //  · `ResumeAnchorStore.deleteBySession` —— **必填**。类型系统已经排除了「没有」的可能,那个
-        //    feature-detect 是**为一个不可达场景**写的分支;注释里「for third-party stores that predate the
-        //    seam」的说法与类型不符(这样的 store 根本进不来)。⇒ 删掉探测,直接调用。真有 JS 层绕过来的
-        //    残缺实现,直接调用抛 TypeError 也是 fail-loud,不必自己写。
-        //  · `SessionPolicyStore.deleteBySession` —— **可选**(且返回 `Promise<void>`,与 anchor 的
-        //    `Promise<number>` 不同;这个差异也是被那个 `as` 抹掉的)。⇒ 探测保留,但缺席时 fail-loud。
-        //
-        // 抛在这里是干净的中止:本段在 §8 的 ①③④ 之前,还没有任何写入落地。
-        await dstBackend.resumeAnchor().deleteBySession(sessionId);
-        const policyWipe = dstBackend.sessionPolicy();
-        if (typeof policyWipe.deleteBySession !== "function") {
-            throw new Error(`overwrite-dst cannot proceed: this deployment's session-policy store has no deleteBySession purge seam, so the destination's policy rows for this session cannot be wiped. Completing the import would leave a MIXED state (the source's conversation plus the destination's stale policy rows, which keep gating), which is worse than the history loss you consented to. Upgrade to a policy store carrying deleteBySession (every in-tree store has it since core 1.423), or re-run without resolution:"overwrite-dst".`);
-        }
-        await policyWipe.deleteBySession(sessionId);
-    }
-    // ── §8 atomic order ─────────────────────────────────────────────────────────────────────────────────────────
-    // ① snapshots — content-addressed blobs + manifest, BEFORE session_meta. Feature-detect importManifest: ALL backends
-    //    now carry it (durable TiDB/PG + core's File/InMemory since 1.141.0) → a local dst imports snapshots for
-    //    real. The only remaining honest-degrade is a backend whose FileSnapshotStore predates the seam (none in-tree).
-    //    importManifest NEVER throws — it returns a FileSnapshotResult; a {ok:false} (rejecting/missing/hash-mismatched
-    //    blob — e.g. corrupted in transit) is re-raised here as a fail-closed THROW so we abort BEFORE the entries commit
-    //    (no entry↔file split). The whole import is the caller's transaction: a throw here means no session_meta is ever
-    //    written (the commit point is inside importEntries, step ②), so the dst stays clean (only collectable orphans).
-    let snapshotsImported = 0;
-    let snapshotsSkipped = 0;
-    if (importFace) {
-        const importManifest = importFace.importManifest;
-        for (const snap of bundle.snapshots) {
-            const r = await importManifest(sessionId, snap.key, new Map(snap.manifest), getBlob);
-            if (!r.ok) {
-                throw new Error(`session-sync import: snapshot import failed for session ${sessionId} key ${snap.key} (${r.error.code}: ${r.error.message}) — fail-closed, refusing a partial-tree import`);
-            }
-            snapshotsImported++;
-        }
-    }
-    else {
-        snapshotsSkipped = bundle.snapshots.length; // pre-1.141.0 dst — files pend the import seam; honest degrade (NOT a silent drop)
-    }
-    // ② entries — core gate (again, authoritative) + session_meta LAST = the commit point. Owner = importingPrincipal
-    //    (NEVER the bundle's, §9). Written via the IDEMPOTENT replaceEntries (purge-then-import) — NOT importEntries,
-    //    whose plain INSERT crashes on a duplicate PK when the session already exists (fast-forward / overwrite-resolved
-    //    / a §8 retry). When the relation is `identical` the log is already present & equal → SKIP the entries write
-    //    entirely (the snapshot/policy/anchor replay below is idempotent and still runs to heal anything missing). A
-    //    destination without the replace seam can't accept a session at all → throw.
-    // 🔴 同上(`session-sync-content.ts` 顶注):`identical` 只说明 id 集合相等,不说明内容相同。这条路上
-    // `bundle.entries` 与目的端日志都在手上 ⇒ 直接比内容摘要;不符就照常改写(不抛错、不 409)。复用 §7 已经
-    // 读到的 `dstEntries`(同一个 dstBackend/sessionId)——这两次读之间 dst 未被任何写触碰(overwrite-dst 擦除
-    // 只在 relation 为 fork/stale 时才跑,identical 分支不可能落进那条腿),不必也不该对同一行重新 exportEntries
-    // 一次(旧实现还用 `.catch(() => null)` 把这次读的故障裸吞成"目的端为空",见下方 identicalIdsAlsoIdenticalContent
-    // 对 null 的处置——一次真实的店读故障会被悄悄当成"内容不等"而不是 fail-loud)。
-    const contentEqual = rel.relation === "identical" && identicalIdsAlsoIdenticalContent(bundle.entries, dstEntries);
-    if (rel.relation !== "identical" || !contentEqual) {
-        const session = ownerAware(dstBackend);
-        const replaceEntries = session.replaceEntries?.bind(session);
-        if (!replaceEntries) {
-            throw new Error(`session-sync import: destination backend (${dstBackend.kind}) has no replaceEntries seam`);
-        }
-        await replaceEntries(sessionId, importingPrincipal, bundle.entries);
-    }
-    // ③ policy — replay each (principal, rules) record VERBATIM. The E6 tighten-only gate is the security boundary here:
-    //    we do NOT pass operator:true unconditionally (a non-operator pushing a client-controlled bundle could otherwise
-    //    LOOSEN an operator-tightened dst session policy — the loosen the E6 route refuses). `opts.operatorOk` defaults
-    //    FALSE → the tighten gate applies, so a TIGHTEN-ONLY import succeeds (design §4 "merge tighten-only") and a
-    //    loosening replay throws SessionPolicyError("loosen_forbidden") — which we do NOT swallow; it propagates to the
-    //    route so the malicious loosen is refused (entries may already have committed: the conversation syncs, only the
-    //    loosen is refused = the correct fail-closed outcome). operator:true ONLY when the AUTHENTICATED importer is a
-    //    verified operator. principal is carried VERBATIM (NOT re-keyed to importingPrincipal): the policy `principal` is
-    //    the per-TASK rule-owner key (`spec.principal`), not the session owner, so re-keying would collapse distinct
-    //    per-principal rows and could clobber. The session-wide row (principal=undefined) stays session-wide and still
-    //    applies to the new owner.
-    //    IDEMPOTENT REPLAY (the A6 fix): a put whose content (rev stripped, normalized) already equals the dst row is
-    //    SKIPPED — putRules bumps `rev` on every write, and `rev` is the optimistic-lock token operators hold for
-    //    read-modify-write. Without the skip, every §8 crash-retry (and every harmless duplicate sync) advances every
-    //    row's rev while changing nothing ⇒ the operator's next putRules({expectedRev}) throws `conflict` on rules whose
-    //    content never moved. With it, retry-after-crash converges to the same BYTES as a single clean run, which is
-    //    what "steps ③/④ are idempotent" (§8 above) actually has to mean. normalizeRules gives both sides the same
-    //    canonical field order/shape, so JSON.stringify is a sound equality here (array ORDER is significant on purpose:
-    //    a reordered list is a different stored byte-state and must be written).
-    const policyStore = dstBackend.sessionPolicy();
-    const canonRules = (r) => JSON.stringify(normalizeRules(stripRev(r)));
-    for (const rec of bundle.policy) {
-        const cur = await policyStore.getRules(sessionId, rec.principal);
-        if (cur !== null && canonRules(cur) === canonRules(rec.rules))
-            continue; // content already identical — don't touch rev
-        await policyStore.putRules(sessionId, rec.principal, rec.rules, { operator: opts?.operatorOk === true });
-    }
-    // ④ anchors — owner RE-KEYED to importingPrincipal (§9): the E18 owner-guard resolves under the NEW owner so
-    //    rewind-to-message keeps working post-move (the source owner, e.g. local null, would never resolve in the cloud).
-    const anchorStore = dstBackend.resumeAnchor();
-    for (const a of bundle.anchors) {
-        await anchorStore.put(sessionId, a.eventId, a.entryId, importingPrincipal);
-    }
-    return { snapshotsImported, snapshotsSkipped, relation: rel.relation };
-}
 /**
  * §7 DRY-RUN — classify what importing `sessionId` from `srcBackend` into `dstBackend` WOULD do, WITHOUT writing
- * anything. The route (P1d) calls this to surface a conflict (fork/stale) to the user BEFORE committing an
- * {@link importSession} (so the shell can present a keep-local / keep-cloud / fork-new choice up front).
+ * anything (the shell can present a keep-local / keep-cloud / fork-new choice up front).
  *
  * Returns `null` when the SOURCE session does not exist (no bundle to plan); otherwise the {@link SyncRelation}
  * between the source's full durable log and the destination's current log (a `null` dst log ⇒ `fresh`). No writes.
@@ -386,4 +84,64 @@ export async function planSync(sessionId, srcBackend, dstBackend) {
     const dstEntries = (await ownerAware(dstBackend).exportEntries?.(sessionId)) ?? null;
     return classifySyncRelationship(srcEntries, dstEntries);
 }
+// ═══ #137 —— 死码 importSession 独有保护的活路由移植(910c524 顶注 TOMBSTONE 两缺口的修复面)═══
+// 本段是「测红复现(fanout-characterization #137 L1/L2)→ 修绿」的绿半场;顶注 TOMBSTONE 的
+// 「NO live-route equivalent」声明随本批作废(保留原文供考古,状态以本段+路由接线为准)。
+/** #137 ①(死码 A6 修的移植):同内容判据 —— 比较「归一化、去 rev」后的字节形。putRules 每次
+ *  无条件写都 rev+1,而 rev 是 operator 乐观锁的 CAS 令牌(`PutRulesOptions.expectedRev`),
+ *  幂等重试/无害重复同步不该把在途 CAS 打失败。归一化用 core 的 `normalizeRules`(store 落盘
+ *  前走同一函数 ⇒ 两侧同坐标);`stripRev` 去掉记录内嵌的 rev(`listBySession` 的 rules 含 rev,
+ *  它不是内容)。 */
+export function sameRulesContent(stored, incoming) {
+    if (stored === null)
+        return false;
+    const norm = (r) => JSON.stringify(normalizeRules(stripRev(r)));
+    return norm(stored) === norm(incoming);
+}
+/** #137 ① 的重放腿共享实现:PUSH 路由的两条 policy 重放腿(Phase A identical 短路支 / Phase B
+ *  commit 后支)都从这里走 —— 等内容跳过(rev 零漂移),真变更照常落地(E6 tighten-only 门在
+ *  putRules 内部,此处不重述)。 */
+export async function replayPolicyRecords(store, sessionId, records, operatorOk) {
+    for (const rec of records) {
+        const cur = await store.getRules(sessionId, rec.principal);
+        if (sameRulesContent(cur, rec.rules))
+            continue;
+        await store.putRules(sessionId, rec.principal, rec.rules, { operator: operatorOk });
+    }
+}
+/** #137 ② 能力预检(fail-loud 方向,[2195] 判据:保护型能力缺席=fail-closed):consented
+ *  overwrite-dst 需要 policy 店的 `deleteBySession` purge seam 才能不留混合态;缺席=true,路由在
+ *  commit **之前**用它干净中止(此时零写入落地),wire 拒因字面量归路由所有(api-error-text-freeze
+ *  锚字面站点)。anchor 店的 deleteBySession 是类型必填、快照店有 core 必填的 `reap` 兜底,都不构成
+ *  缺席面;唯一可缺的就是 policy 这条(core 接口上是可选方法)。 */
+export function overwriteWipeIncapable(policyStore) {
+    return policyStore !== undefined && typeof policyStore.deleteBySession !== "function";
+}
+/** #137 ②(死码 ⓪ 擦除步的移植):consented overwrite-dst = keep-source,结果必须是**源端那
+ *  一份**,不得混成「源端对话 + 目的端遗留 policy/anchor/快照」(混合态比丢历史更危险:悬空
+ *  anchor 指向已 purge 的 entry、被放弃分支的 policy 行继续 gating、共享 key 快照因
+ *  importManifest create-once 永远留着目的端字节)。调用时点=commit(原子 swap)成功**之后**、
+ *  附随物重放**之前**:死码在任何写入前擦(其 entries 写本身非原子);活路由有真 commit point,
+ *  擦在 commit 前会在「commit 失败」时留下反向混合态(目的端对话完好、附随物已毁)——方向更坏。
+ *  诚实残余:进程在 commit 与本函数之间崩溃时,重试落 Phase A identical 支(无 wipe)⇒ 遗留行
+ *  可存活;该窗口窄于修前世界(修前=遗留行**恒**存活),与 §8「快照重放失败 ⇒ 422 重试自愈」
+ *  同款接受,记录于此不装没有。
+ *  各店姿势(死码 verbatim 语义):快照=deleteBySession(SQL 孪生:manifest 即删、blob 走异步
+ *  孤儿 GC)缺席则 core 必填 `reap(scope, [])`(内容寻址,他 scope 仍引用的 blob 存活);
+ *  anchor=直调(类型必填);policy=deleteBySession(路由已用 {@link overwriteWipeIncapable}
+ *  预检过,此处缺席=类型外的 JS 层残缺实现,直调抛 TypeError 即 fail-loud)。 */
+export async function wipeSessionAttendants(stores, sessionId) {
+    const fs = stores.fileSnapshotStore;
+    if (fs !== undefined) {
+        if (typeof fs.deleteBySession === "function")
+            await fs.deleteBySession(sessionId);
+        else
+            await fs.reap(sessionId, []);
+    }
+    if (stores.resumeAnchorStore !== undefined)
+        await stores.resumeAnchorStore.deleteBySession(sessionId);
+    const policy = stores.sessionPolicyStore;
+    if (policy !== undefined)
+        await policy.deleteBySession(sessionId);
+}
 //# sourceMappingURL=session-sync.js.map

package/dist/spec-fields.js

@@ -69,9 +69,10 @@ export function normalizeAttachments(v) {
         ...(o.todoReminder === true ? { todoReminder: true } : {}),
         ...(changedFiles !== undefined ? { changedFiles } : {}),
         ...(o.planModeReminder === true ? { planModeReminder: true } : {}),
-        // core 1.253 G1: post-compaction background-task recap + deferred-tools boundary notice —
-        // same literal-true contract as the rest of the family (both are one-shot/opt-in on the core side).
-        ...(o.backgroundTasks === true ? { backgroundTasks: true } : {}),
+        // core 1.253 G1 → 5.12.0 BREAKING-3:压缩后 bg 任务重述从 opt-in 翻 **DEFAULT-ON**(显式 false
+        // 恒关/缺席走默认)。literal-true 形在此翻转后就是轴B #1 的原案复刻(agentListing/skillsListing
+        // 当年同病):丢 false = 客户端显式关断被静默压成默认 ON,wire 上无法表达关闭 ⇒ 迁 boolean 透传。
+        ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
         ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
         ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),
         ...(o.budgetUsd === true ? { budgetUsd: true } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "6.6.0",
+  "version": "6.8.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^5.11.0",
+    "@sema-agent/core": "^5.12.0",
     "@sema-agent/registry-core": "^0.14.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",
@@ -68,7 +68,7 @@
     "sharp": "^0.35.3"
   },
   "devDependencies": {
-    "@sema-agent/sdk": "^6.4.0",
+    "@sema-agent/sdk": "^6.5.0",
     "@types/libsodium-wrappers": "^0.7.14",
     "@types/node": "22.10.2",
     "@types/pg": "^8.20.0",